CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.2-517 - Upgrade
Upgrade
Pod::Textto a version that resolves this vulnerability.Fixed in 6.1.1 - Compensating control
Avoid formatting untrusted attacker-supplied POD documents with Pod::Text (e.g., do not process untrusted POD input through podlators/Pod::Text).
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using Pod::Text before version 6.1.1 are exposed when they format POD documents supplied by an attacker or another untrusted source.
What does an attacker need to trigger the issue?
The attacker needs to provide a POD document with sufficiently nested =over directives to drive the formatting margin to the output width. When that document is formatted, processing can fail to return and memory consumption can continue growing.
How can I determine whether an installation is affected?
Check the installed Pod::Text version. Versions earlier than 6.1.1 are affected.
What is the available remediation?
Upgrade Pod::Text to version 6.1.1 or later.